On Fri, Mar 3, 2017 at 8:22 AM, Florian Westphal <[email protected]> wrote: > Paul Moore <[email protected]> wrote: >> On Fri, Mar 3, 2017 at 7:45 AM, Florian Westphal <[email protected]> wrote: >> > Richard Guy Briggs <[email protected]> wrote: >> >> > Perhaps I'm missing something here, but let me ask again, how does >> >> > userspace distinguish between an unset nfmark and a nfmark of >> >> > 0xffffffff? >> >> >> >> It can't. >> > >> > It can if you log it as 0, as I asked in patch 1 review. >> > >> > (You wouldn't log sk uid of 0 as -1 either, would you?) >> >> I want to see the code able to handle the full range of nfmark values >> as well as the unset case; if that means we need to tweak userspace a >> bit, please work with Steve on that. > > There is no 'unset nfmark'. Its just a 32bit integer.
Yes, my apologies, this thread has dragged on so long I muddled the details in my mind ... here is what I'm trying to get at, Richard's latest patch (unless I've missed one in my inbox) has the following line: audit_log_format(ab, "mark=%#x", skb->mark ?: -1); ... which I believe to be incorrect. I was trying to lead Richard along to that same realization, but it would appear I'm not having much success, so to put it bluntly, here is what I want that line to look like: audit_log_format(ab, "mark=%#x", skb->mark); -- paul moore www.paul-moore.com -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
